[libsoup] Don't do SSLv3 fallback if TLS fails

[Dan Winship <danw src gnome org>]

commit 205342c243ae68e3f96b6cee2a280c302f6bbc8d
Author: Dan Winship <danw gnome org>
Date:   Tue May 3 14:11:35 2016 -0400

    Don't do SSLv3 fallback if TLS fails
    
    Firefox and Chrome have both removed support for this. Fix your
    server!
    
    (This is still supported by SoupSocket, since removing that would be
    an API break, but SoupSession never makes use of the feature now.)
    
    https://bugzilla.gnome.org/show_bug.cgi?id=765940

 libsoup/soup-connection.c |   24 +-----------------------
 libsoup/soup-connection.h |    3 ---
 libsoup/soup-session.c    |   20 +-------------------
 3 files changed, 2 insertions(+), 45 deletions(-)
---
diff --git a/libsoup/soup-connection.c b/libsoup/soup-connection.c
index 77b1c8b..00fd4c3 100644
--- a/libsoup/soup-connection.c
+++ b/libsoup/soup-connection.c
@@ -19,7 +19,7 @@ typedef struct {
        SoupSocketProperties *socket_props;
 
        SoupURI *remote_uri, *proxy_uri;
-       gboolean ssl, ssl_fallback;
+       gboolean ssl;
 
        SoupMessage *current_msg;
        SoupConnectionState state;
@@ -43,7 +43,6 @@ enum {
        PROP_0,
 
        PROP_REMOTE_URI,
-       PROP_SSL_FALLBACK,
        PROP_SOCKET_PROPERTIES,
        PROP_STATE,
 
@@ -105,9 +104,6 @@ soup_connection_set_property (GObject *object, guint prop_id,
                else
                        priv->ssl = FALSE;
                break;
-       case PROP_SSL_FALLBACK:
-               priv->ssl_fallback = g_value_get_boolean (value);
-               break;
        case PROP_SOCKET_PROPERTIES:
                priv->socket_props = g_value_dup_boxed (value);
                break;
@@ -130,9 +126,6 @@ soup_connection_get_property (GObject *object, guint prop_id,
        case PROP_REMOTE_URI:
                g_value_set_boxed (value, priv->remote_uri);
                break;
-       case PROP_SSL_FALLBACK:
-               g_value_set_boolean (value, priv->ssl_fallback);
-               break;
        case PROP_SOCKET_PROPERTIES:
                g_value_set_boxed (value, priv->socket_props);
                break;
@@ -187,13 +180,6 @@ soup_connection_class_init (SoupConnectionClass *connection_class)
                                    SOUP_TYPE_URI,
                                    G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
        g_object_class_install_property (
-               object_class, PROP_SSL_FALLBACK,
-               g_param_spec_boolean (SOUP_CONNECTION_SSL_FALLBACK,
-                                     "SSLv3 fallback",
-                                     "Use SSLv3 instead of TLS",
-                                     FALSE,
-                                     G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
-       g_object_class_install_property (
                object_class, PROP_SOCKET_PROPERTIES,
                g_param_spec_boxed (SOUP_CONNECTION_SOCKET_PROPERTIES,
                                    "Socket properties",
@@ -412,7 +398,6 @@ soup_connection_connect_async (SoupConnection      *conn,
 
        priv->socket =
                soup_socket_new (SOUP_SOCKET_REMOTE_ADDRESS, remote_addr,
-                                SOUP_SOCKET_SSL_FALLBACK, priv->ssl_fallback,
                                 SOUP_SOCKET_SOCKET_PROPERTIES, priv->socket_props,
                                 NULL);
        g_object_unref (remote_addr);
@@ -460,7 +445,6 @@ soup_connection_connect_sync (SoupConnection  *conn,
 
        priv->socket =
                soup_socket_new (SOUP_SOCKET_REMOTE_ADDRESS, remote_addr,
-                                SOUP_SOCKET_SSL_FALLBACK, priv->ssl_fallback,
                                 SOUP_SOCKET_SOCKET_PROPERTIES, priv->socket_props,
                                 SOUP_SOCKET_FLAG_NONBLOCKING, FALSE,
                                 NULL);
@@ -695,12 +679,6 @@ soup_connection_get_ever_used (SoupConnection *conn)
        return SOUP_CONNECTION_GET_PRIVATE (conn)->unused_timeout == 0;
 }
 
-gboolean
-soup_connection_get_ssl_fallback (SoupConnection *conn)
-{
-       return SOUP_CONNECTION_GET_PRIVATE (conn)->ssl_fallback;
-}
-
 void
 soup_connection_send_request (SoupConnection          *conn,
                              SoupMessageQueueItem    *item,
diff --git a/libsoup/soup-connection.h b/libsoup/soup-connection.h
index 8df6112..3da217f 100644
--- a/libsoup/soup-connection.h
+++ b/libsoup/soup-connection.h
@@ -36,7 +36,6 @@ GType soup_connection_get_type (void);
 
 
 #define SOUP_CONNECTION_REMOTE_URI        "remote-uri"
-#define SOUP_CONNECTION_SSL_FALLBACK      "ssl-fallback"
 #define SOUP_CONNECTION_SOCKET_PROPERTIES "socket-properties"
 #define SOUP_CONNECTION_STATE             "state"
 
@@ -80,8 +79,6 @@ void            soup_connection_send_request   (SoupConnection          *conn,
                                                SoupMessageCompletionFn  completion_cb,
                                                gpointer                 user_data);
 
-gboolean        soup_connection_get_ssl_fallback (SoupConnection   *conn);
-
 G_END_DECLS
 
 #endif /* SOUP_CONNECTION_H */
diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c
index 9831172..0f02519 100644
--- a/libsoup/soup-session.c
+++ b/libsoup/soup-session.c
@@ -86,8 +86,6 @@ typedef struct {
 
        guint        num_messages;
 
-       gboolean     ssl_fallback;
-
        GSource     *keep_alive_src;
        SoupSession *session;
 } SoupSessionHost;
@@ -1431,9 +1429,6 @@ drop_connection (SoupSession *session, SoupSessionHost *host, SoupConnection *co
                                                                 host);
                        host->keep_alive_src = g_source_ref (host->keep_alive_src);
                }
-
-               if (soup_connection_get_ssl_fallback (conn))
-                       host->ssl_fallback = TRUE;
        }
 
        g_signal_handlers_disconnect_by_func (conn, connection_disconnected, session);
@@ -1607,19 +1602,7 @@ status_from_connect_error (SoupMessageQueueItem *item, GError *error)
        if (!error)
                return SOUP_STATUS_OK;
 
-       if (g_error_matches (error, G_TLS_ERROR, G_TLS_ERROR_NOT_TLS)) {
-               SoupSessionPrivate *priv = SOUP_SESSION_GET_PRIVATE (item->session);
-               SoupSessionHost *host;
-
-               g_mutex_lock (&priv->conn_lock);
-               host = get_host_for_message (item->session, item->msg);
-               if (!host->ssl_fallback) {
-                       host->ssl_fallback = TRUE;
-                       status = SOUP_STATUS_TRY_AGAIN;
-               } else
-                       status = SOUP_STATUS_SSL_FAILED;
-               g_mutex_unlock (&priv->conn_lock);
-       } else if (error->domain == G_TLS_ERROR)
+       if (error->domain == G_TLS_ERROR)
                status = SOUP_STATUS_SSL_FAILED;
        else if (error->domain == G_RESOLVER_ERROR)
                status = SOUP_STATUS_CANT_RESOLVE;
@@ -1870,7 +1853,6 @@ get_connection_for_host (SoupSession *session,
        ensure_socket_props (session);
        conn = g_object_new (SOUP_TYPE_CONNECTION,
                             SOUP_CONNECTION_REMOTE_URI, host->uri,
-                            SOUP_CONNECTION_SSL_FALLBACK, host->ssl_fallback,
                             SOUP_CONNECTION_SOCKET_PROPERTIES, priv->socket_props,
                             NULL);